Analysis
-
max time kernel
139s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 00:07
Static task
static1
Behavioral task
behavioral1
Sample
43b2b2998ecdefb0110422d70766ead0_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
43b2b2998ecdefb0110422d70766ead0_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
43b2b2998ecdefb0110422d70766ead0_JaffaCakes118.html
-
Size
14KB
-
MD5
43b2b2998ecdefb0110422d70766ead0
-
SHA1
9686ba9e24e2d1b04104335ca07cdee4b9522919
-
SHA256
0720ccb2dbd4219c42339d5975bdcdd7613a05d6de425f63de8e06ce3c3405ca
-
SHA512
0cbabb8a845262ba650b111895ede7314f4b6e00e28ae03a53c82acca727c885e4ebf64c33eac82c3ff5ace76b625240435fd26d5ba082409ba87a340befd505
-
SSDEEP
384:hNDuBJKVyUvziHkmqlCrhOb3StMIRalaMk:LK+y8iTtBRy+
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1062c3e65ba6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421893491" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0F792281-124F-11EF-B781-461900256DFE} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000063e1ed671b8f4c12309939c393ac865aaebbbc73843d27810bb83e9dd3ce172000000000e80000000020000200000009aeb1ea4fb086f844367db42cbedc2d7b49ebc20ec185eac7b9f64c234b89e5890000000e06c680c60d9b31235c0eb0dc1c005ffd48858a2a5e0cfcec594322790ac0fe2b01cec96ced290a0639653976efe3306d40943f3daef3ce1b4abf18bd09b18e6233f5565e4312f1545b7092ee6cae48b7bdbf712d91513ad5876df981944419a14eb4e1186b76db089677b8e004b21000739799eee33adb7b28d0ff34e1f74aeb72730f9e9d53d86bb5e78f5f0e0460440000000e650ebea1e724e0ab1be23d167abc81e7e7db0342dbf6c90d32d2ab2a2f76b84f86676fe4fac9a3fa38b10d1842b71c8538f2e4e8c12ebbfb42d501ba97cb073 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000ae48241702ff0f890d3eceaf2e9ea7f73156786e14bf93a23da55612a434811e000000000e80000000020000200000002950ac8c5e8d2c2952660665b0c844d43b4b923989d52df13f4d8962010cffb92000000047ca45e94149b3ee8e84d78d2bdc95a6be266cb6c973ef966ac687cdf38cfc1b4000000023a1d4b21d970adddce604be1a60ea1a270ba3a432486af01de5540298b8c197ce26c0a460cdc56dbd497670fa90c0c67811beb269247e74d6332e075bc26027 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3012 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3012 iexplore.exe 3012 iexplore.exe 2080 IEXPLORE.EXE 2080 IEXPLORE.EXE 2080 IEXPLORE.EXE 2080 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3012 wrote to memory of 2080 3012 iexplore.exe 28 PID 3012 wrote to memory of 2080 3012 iexplore.exe 28 PID 3012 wrote to memory of 2080 3012 iexplore.exe 28 PID 3012 wrote to memory of 2080 3012 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\43b2b2998ecdefb0110422d70766ead0_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3012 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2080
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559a7f62fd8ad6ffc16873c9159221315
SHA1ba61639d45ac15b4f8f75863b7314e86ef32cbe2
SHA25673d2a70ed015295213ac8a07c8ec30b53592e0251538d434882580e732044e64
SHA512aa8f05aab683844b2c060eabf0bfbb821eb1562fa18d214e0092889f5ad7e3a8554c15d1ae4be0e984c08f3641acf9bc416ac7132d78dea78aeab0bab7c736c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58de05870ff0fc2bed4a7c6620e8942f6
SHA11655d719a9f082d6d413b15b255203f0bdcd56e2
SHA2560f0c2d4d763b82ea5ed8ad9d916eddf7fc1803c1918d12c90abf2195c1b33c47
SHA5128a0a2158e96ea11eee2ba8636162f76956e89c2becd5cc63c95176009499a6cffc409c63c8cf7bfe72572eeb53b15bc8d857fb29a07700e933211c386b32f0e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba39108d19b235b89fa1fdb5b5e40c6e
SHA17dbb272d08fd9aa41f86bf2b784ad795065a43db
SHA256d9ccac96bf8835499f23f321c84886bcccb0b7e7fb8363c6fd218c3f089364e5
SHA5125eeecd63bcdb2e9c0c4af4f1b3941b67c4764ec13d47b33f14eac926019497bfeac5505bd895012b68e6b804d696728b55e86c697546d2a0a29f8b7b195b0ffb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c6863c972a1dd2f9a6fd1e8ff1b1783
SHA161e7c27a5db5074cbbd1eadcaf4a917cf2dbb673
SHA256ce01542cfe3daf3b9a695258d932274bd2834b2914036aed1c8a23e86637a83a
SHA512a3c28d30979cbbcfe765b1953752e79b9d2e21b1c5e117a98ee807f8104e86818fab4dd2bb66cba7f597b53d42723ff2d5aa276582c3a72bf9d51066faa80fd8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59ccf00b0f50f51409d3cb13637f91eac
SHA1516e15479599b5a96d098bffac3a7ac0b4af98de
SHA256174de03c87ab928c070ecba368bed7d46ee6262222814ad6e821b6810aec473a
SHA5122cbf10a0531e4c60aec3bc42fb655e3e956b53e58f19ff18399f9c26f6bd6ed9af77c891924e5fba0b7e64e83288b30d23f50c3ff72ffc65107ebca80d0ed91b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd20c6dff0dcd19e49b59f96c921b206
SHA1ddf39e54f517cd6ad5522430daca83551f55d322
SHA2561f0591a8f3a37d787e76d11b345f171a9f3c966c824241cc95055acc9705256f
SHA51205f6741c2ca24fa233134c4e306dc768db7f44d6ea3785307a90b9ee2fb03a48a3de8bc264eca14d7e939f939cd7019d02dd38645dd16a55445d1c8806f6ffee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aa70da8fa60abf18c3c39028fdbcf52b
SHA14fec7967aee697354b62cd888d701f17435ddefd
SHA25685ae7b73cbc7000af13a96bd1f0c5def5add0d10bacf720ed85153b3c1b6127f
SHA512fd5a5816f2cf9a97a584e187cc03c728817b8b9fb25f70d304584e23c50a16f70bc9273c536b7623513531d4ef559caa85fd950d622a3c192b67e06083217b74
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD550e560ce1f8303cc6a5548e7b7c8dd39
SHA1813dbdd683aa6eab138367c6a9f725544906d1fe
SHA2565607faba5d7de0dad6fd67555697bd041aeefdda1819f0970f1c99286eb5b2e2
SHA512d54a8adb58ce097de2c9b63d303c7586f46b847c95fb1d1bd814f8e0d272fa4b7f07ab54ba478881e1849b531636f9eeb1df0f82b9d37f2f468bbc8efa409fa3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59a26ba310f49bbdc05d1b267c3440bfd
SHA1aa9701c3820a39d579dedfb4272e5a1fd7d2df5c
SHA256baa5030df598dcdb5b93c5944eb11f265295485549a74520779aa26e85acb2d0
SHA512f7d1c624ebd8f2d82c9f8a8f5dad9efc2a205f80d0b36799bceb92ec19a002441fca774fa4be8f574962101ff58068dbc9980d08d5f1a009906ac49a6288b332
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD555111d663353d22588ffda9b943ca306
SHA1381c80d1cc1eb79b052dd074085c49d741fa2f91
SHA2568c49516f9df051f2dc49f75d2e89e1e9286ad594247ea27cc3934c8245c1aadc
SHA5122d314b3223b1e69c19705494b99348d7ce4c2ebda8876d2c6d0b96a0b4c6385a82d141b84d5ee4f5ad6479c0625599c8b5edfe1a561cbbcc8a1f044761496dca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57386ff995769bf321d5033a6c7703a20
SHA10de0ef2565c7832385a1e7cf2a94cf447adfb708
SHA256842869d8bbf45ab84ddce0144f243273bf9c2d2269fb0d6adb7f4b6a727ededc
SHA51203ffc8d18632e4c0aa6b7da0f05f5f4e03aafad680b2e383f0cab34006da291d76ad7eb6484f8e093b4b6ea8092e00c6675b9510274f8df0676b60f9a18b2f83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e8d9e19f7ed37974db4c7523758a7c8f
SHA1a26930017d1ac032bec2d6bdf534b70a5a72905c
SHA256e38dee763436bb0197a2d07151e9d7191b59ca4a6d7a3dd247b95c980eca7419
SHA512ade2b714d5e55fc4545c9ceffe0c60354fa84bb951241df4b825f12cc8f7bfc00bfd745fac43813f53130deb7d64ed7d9bfa99038e50760e5047b890c6415828
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e0c9fc8cb850d65be6d2628032d7fc77
SHA1dc86b892f725488854a4b5a8b45edc68c60b5b20
SHA2568039d1aac521e0580d0147f63cdbcb57766c5f39e13389fc70acf993790ee502
SHA512f63c65263adc71b94f4193280a823cce5b987ecb1bc1a607fda25a08f7d25096dbbe3481783fe493a0824075c05b807952b5b87cc751504e9bcd64660716a2d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bf2e6dae62ea4c97d78d219044bdbc7e
SHA18e67441b991d1187513219596cce4480a4aa5619
SHA256bcbb4d411738638cc0fd1990f897b9c6ced8ed1a38dd245af887ded446bfd108
SHA512fd420ae8be4513e759a53b36dd2286b8b538d4f99a611be21a5684af0846387ede9666e5968fdcee4f2bae5aea11db7f03225dbf3535894ae5525480d0416902
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da87839a5466dbacba610b94af755488
SHA1783584e0206582cbc7cd2fdecb86aed76e158fb2
SHA25658e4b32fe29935bc370038d2ac8149c4164c7002082e0cddb7ad4bb99ae990bd
SHA5120829f6221ea54d2a9a2c95ce46ed6cd51f25fb7192d21dbc5edfacc227eb24f245307fe0ec0ef7e85e5c919326b824569feffc6fdc9a4a2dbf2144debda336ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58c99e39b0643faca6ef4fc9184cc108b
SHA151fe45099be5e5fd054fb5bad830c10213d23f8c
SHA25657a74878fb4f9cb56ad08d831d7460ff1826ac21b0b5342f349a162410a52a89
SHA512f4287bbea1583ad001d3db55beb173cd0ba4852a397c5484852476d6d5b9defea0a26ab621c8fba9d45f9dfb0994b7eee0f52698536d3dff2024de6b6191d8e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD592ddcaef993196e6ad421a5f832b9725
SHA1cbace76f6fefd1e86aa55ff7feb000189b19a48f
SHA256fedd4af12273f6e9abaa7a05df8e1ab40255b4befb28a8af5000da1cdeb5239c
SHA512fa05384d79cf6cf6820b6e9b30e937a4096023ca1d95d50bb966c2ee109f2b0440e63118306ab4c98cbff9ecbc67a9f273044ba05bad2b95e073df0087b974c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD562c9a67962dca89efdd8163c4f405f0d
SHA103d934a76daae8dcf6d4a2d0ea8c01596f7ae458
SHA25672877302099907f2f8ffa1cf45fbe753adb37b13cab0a42e685768889b7e49c8
SHA512a0a9b56bdaa060b452fdd6b5962323dabb919274dcc1587658a1a98838eeab10dfb4e61f3c7a2415b63f0e263c0b8ff20e69c42304cf69815edb8a4407b9c3ed
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a